Abandoned Popcorn Time app exposed millions of devices to RCE attacks
-
Researchers have disclosed and remotely mitigated a serious flaw in Time4Popcorn, an abandoned fork of the Popcorn Time BitTorrent client, that put millions of computers at risk of remote code execution. The vulnerable component was the app's updater, which could have been abused by attackers to run malicious code with elevated privileges on affected systems.
Because the project is no longer maintained and the updater remained active, the research team took the unusual step of remotely disabling it themselves, effectively closing the attack vector for the entire install base rather than waiting on a patch that would never come. This is a notable case of abandoned software continuing to carry risk long after development stops, since update mechanisms often run with high privileges and can serve as a foothold if they fall into the wrong hands.
- The affected application is the discontinued Time4Popcorn client.
- The vulnerable component is its auto-updater, which could enable code execution with elevated privileges.
- Researchers remotely disabled the updater to neutralize the flaw for existing users.
If you or anyone you know still has this client installed, uninstalling it entirely is the safest path, as no official fixes will be coming.
Source: Unknown
Have you come across abandoned applications still running privileged updaters in your environment, and how are you handling them?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login